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ABSTRACT 


The  development  team  responsible  for  creation  of  the  automated  aerosol  and  xenon  sampling  systems  is  continuing 
to  solve  problems  related  to  the  operation  of  automated  systems  for  nuclear  explosion  monitoring.  Several  typical 
problems  are  presented  here  to  characterize  that  effort.  First,  the  development  of  tools  for  the  efficient  use  of  state - 
of-health  information  is  in  progress.  Second,  first-generation  code  segments  useful  for  authenticating  data  have  been 
developed  and  are  discussed.  Finally,  the  computations  and  experiments  quantifying  the  effects  of  cascade  summing 
in  the  operation  of  aerosol  monitoring  radiation  detectors  are  discussed. 

Both  the  Radionuclide  Aerosol  Sampler/ Analyzer  (RASA)  and  the  Automatic  Radioxenon  Sampler/ Analyzer 
(ARSA)  gather  state-of-health  data  (Miley,  1998;  Bowyer,  1999).  These  data  are  stored  and  forwarded  to  a  data 
center,  such  as  the  US  National  Data  Center.  Tools  to  simply  visualize  (with  template  eye  guides)  have  been 
constructed.  State-of-heath  data  from  operational  RASA  units  and  specially  designed  experiments  have  been 
analyzed  to  demonstrate  the  ability  to  detect  minute  trends  leading  to  failure.  This  analysis  should  allow  systems 
maintenance  staff  some  predictive  capability. 

Providing  a  digital  signature  on  a  data  transmission  serves  to  authenticate  both  that  the  message  comes  from  a 
trusted  source  and  that  it  has  not  been  altered  in  any  way.  In  addition,  digital  signature  also  makes  the  message 
undeniable:  that  is,  it  cannot  be  disputed  that  this  message  came  from  some  other  source  or  was  fabricated. 
Authentication  software  has  been  produced  in  collaboration  with  Sandia  National  Laboratories  and  has  undergone 
extensive  testing  on  operational  and  test  RASA  units.  Authentication  code  must  implement  the  policy  logic  of  an 
overall  authentication  infrastructure.  Policy  decisions  for  data  authentication  have  not  been  completely  set  at  this 
time.  Because  of  this  and  the  rapidly  changing  standards  environment  for  authentication  code  today,  this  work  will 
likely  require  extension  to  cover  other  authentication  standards. 

Cascade  summing  occurs  when  two  gamma-rays  emitted  in  the  decay  of  a  single  nucleus  both  deposit  energy  in  a 
detector.  In  addition  to  (or  instead  of)  the  familiar  set  of  peaks  and  continuum  usually  uniquely  associated  with  an 
isotope,  higher  energy  peaks  and  continuum  are  observed.  This  effect  occurs  predominantly  where  the  source  is 
located  close  to  the  detector  for  maximum  sensitivity,  as  in  the  International  Monitoring  System  aerosol  stations, 
including  the  RASA.  The  size  of  the  effect  may  be  computed  by  various  means,  including  Monte  Carlo  simulation. 
Computations  have  been  compared  to  experiment  to  show  that  in  most  cases  the  effect  of  summing  is  modest  but 
perceptible.  Certain  extreme  cases  can  show  dramatic  effect.  The  impact  on  efficiency  measurements  and  certain 
fission  products  will  be  shown. 
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OBJECTIVE 

State -of  Health  Data 

The  general  goals  of  State-of-Health  (SOH)  data  gathering  are  to  detect  failures  in  the  monitored  process  and  to 
predict  failures  sufficiently  ahead  of  time  to  minimize  downtime.  These  goals  can  be  separated  into  three  distinct 
components:  bounds  checking  on  current  SOH  values,  trend  detection  in  SOH  values,  and  fault  detection/prediction 
based  on  detailed  system  knowledge.  The  philosophy  of  SOH  development  taken  at  Pacific  Northwest  National 
Laboratory  (PNNL)  is  first  to  facilitate  development,  then  to  gradually  analyze  SOH  parameters  for  failure - 
prediction  capability.  Finally,  the  production  of  tools  to  automatically  examine  SOH  data  will  greatly  reduce  staffing 
needs  while  maximizing  uptime.  Because  of  the  limited  field  experience  with  the  RASA  and  ARSA,  it  is  not  well 
known  what  the  most  likely  failure  modes  will  be.  Thus,  as  the  operational  experience  base  expands,  more  SOH 
parameters  can  be  studied  meaningfully. 

Bounds  checking  of  SOH  values  can  be  implemented  relatively  easily  by  creating  a  software  process  that  compares 
each  new  SOH  value  to  a  pre-established  range.  This  function  in  the  RASA,  for  instance,  automatically  generates  an 
alert  e-mail  to  a  pre -specified  e-mail  address  describing  the  anomaly.  The  bounds  range  was  originally  established 
by  histogramming  a  one-year  sample  of  5-minute  resolution  values.  The  4  sigma  limits  of  these  values  were  chosen 
to  limit  false  alarm  alerts.  This  approach  created  a  fairly  narrow  operation  range.  Unfortunately,  conditions  such  as 
extreme  weather,  air  conditioning  failure,  or  other  factors  unrelated  to  the  RASA  directly  have  the  ability  to  force 
the  SOH  values  out  of  a  narrowly  defined  range. 

After  a  single  system  generated  600  alert  e-mails  in  one  weekend,  it  became  generally  acknowledged  that  the  SOH 
value  range  needed  to  be  sufficiently  broad  to  limit  alerts  to  obvious  problems.  The  current  idea  for  setting  this 
range  is  to  specify  the  nominal  range  of  values  (temperatures,  currents,  etc.)  specified  by  subsystem  suppliers.  This 
is  less  sensitive  to  excursions  but  does  not  produce  too  many  false  alarms. 

While  bounds  checking  can  and  should  be 
done  on  the  monitored  system,  trend 
analysis  need  not  be  done  on  the  RASA  or 
ARSA.  It  may  be  sufficient  to  operate 
well-known  process  control  software  at 
the  Data  Center  to  examine  these  data. 

However,  many  of  the  SOH  parameters 
are  not  naturally  steady:  for  example 
diurnal  variations  are  found  in  all  RASA 
SOH  temperatures.  ARSA  components 
normally  undergo  sizeable  temperature 
swings  every  eight  hours  (Fig.  1).  Thus, 
strong  recurring  patterns  need  to  be 
mathematically  nulled  or  accounted  for  in 
the  mathematical  trend  model.  Nulling 
can  be  accomplished  effectively  by  taking 
the  difference  of  two  similar  SOH 
parameters.  It  is  preferable  that  one  is  not 
dependent  on  system  performance. 

Outdoor  air  temperature  or  room 
temperature  would  be  good  examples  of 
independent  parameters.  Figure  1 .  ARSA  SOH  Viewer 

Because  the  development  teams  of  the  RASA  and  ARSA  are  still  involved  with  the  successful  technology  transfer  to 
industry,  it  is  possible  to  combine  the  RASA  and  ARSA  development  experience  with  mathematical  and  statistical 
methods  to  explore  system  failure  predictions.  Exploratory  work  of  this  sort  has  begun  with  the  analysis  of  the 
temperature  of  the  RASA  blower  motor  and  the  current  drawn  by  the  RASA  filter  advance  motor.  Although  the 
germanium  detector  seems  to  be  the  most  failure -prone  item,  these  motors  are  the  critical  mechanical  components  of 
the  RASA.  The  goal  of  the  SOH  analysis  is  to  predict  failures  far  enough  in  advance  to  allow  a  service  call  that 
eliminates  or  minimizes  downtime. 
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Blower  Motor  Thermal  Test 


To  produce  unambiguous  data  for  the  blower  motor  temperature  analysis,  researchers  agreed  that  the  commercially 
produced  RASA  would  be  left  undisturbed  for  one  month.  In  the  fourth  week,  heat  would  be  gradually  applied  to  the 
motor  to  simulate  or  perhaps  cause  a  bearing  failure.  Fortunately  or  unfortunately,  a  real  failure  occurred  about  450 
hours  into  the  test  (Fig.  2).  The  failure  was  of  a  type  unknown  on  the  PNNL  prototype:  when  one  or  more  filter 
strips  terminates  unexpectedly  and  the  RASA  continues  to  draw  air,  the  blower  motor  can  rapidly  increase  in 
temperature  and  emit  a  hot  smell.  After  a  cool-down  period  and  replacement  of  the  filter  strip,  the  motor  will  return 
to  normal  operation. 


Figure  2.  Temperature  difference  in  degrees  Celsius  (black)  vs.  SARIMA  predictions  (red).  Model  was  trained 
on  first  240  hours  data. 


The  strong  diurnal  variation  in  the  raw 
blower  temperature  was  suppressed  by 
subtracting  the  inlet  air  temperature. 

Multiplying  the  inlet  air  temperature 
by  some  factor  and  also  subtracting  a 
fixed  offset  could  have  nulled  the 
remaining  diurnal  variation  more 
effectively.  However,  models  were 
selected  which  naturally  included 
diurnal  variations.  The  time  series 
models  employed  are  formally  known 
a  seasonal  autoregressive  integrated 
moving  average  (SARIMA)  models. 

Obviously,  this  method  has  excellent 
predictive  power,  but  the  predictions 
are  not  sufficiently  far  out  in  the  future 
to  say  that  we  have  reached  our  goal 

of  failure  prediction,  at  least  for  this  sudden-onset  phenomenon.  However,  this  model  can  be  tuned  to  find  patterns 
super-imposed  on  normal  diurnal  variation  and  to  generate  an  alarm.  As  a  crude  example,  the  cuscore  statistic  is 


100  200  300  400  500 

Figure  3.  Cuscore  statistic  showing  blower  failure  detection. 


shown  for  the  blower  failure  example  below.  The  failure  is  seen  in  figure  3  as  a  dramatic  excursion  of  the  cuscore 
with  a  minor  accidental  excursion  at  about  133  hours.  The  bounds  on  the  cuscore  represent  a  much  tighter  bound 
than  that  in  the  simple  alerts.  Furthermore,  the  cuscore  can  be  tuned  to  be  sensitive  to  expected  failure  onset 
patterns. 

Advance  Motor  Current  Analysis 

As  a  surrogate  indicator  for  RASA  filter  paper  jams,  advance  motor  current  can  be  used  to  identify  excessive  motor 
load.  Minimum,  maximum,  and  average  current  during  motor  operation  comprise  the  SOH  monitoring  data  (Fig.  4). 
These  three  measurements  should  be  used  since  the  range  of  motor  current  can  be  indicative  of  filter  paper  jam  as 


t 


Figure  4.  Advance  motor  SOH  measurements  (Mahalanobis  distance)  derived  from  advance  motor 
current  data.  Extreme  SOH  measurements  correspond  to  filter  paper  jams.  Extreme  SOH  measurements 
serve  as  surrogate  indicator  for  filter  paper  jams. 


well  as  the  average  motor  current.  Outlier  data  from  the  USX01  advance  motor  were  identified  as  real  failures  or 
false  failures  (maintenance  activities  can  produce  unusual  advance  motor  current).  Once  the  real  and  false  failures 
were  determined,  the  false  failures  were  removed  from  the  data  set. 

The  Mahalanobis  distance  (relative  to  the  nominal  data)  of  the  403  observations  are  plotted  versus  time  (Fig.  4). 

The  known  failures  for  the  USX01  advanced  motor  stand  apart  from  the  nominal  data  in  an  obvious  manner.  We 
have  found  that  all  three  SOH  measures  (minimum,  maximum,  and  average  current)  are  necessary  to  identify 
excessive  motor  load.  If  only  one  metric  had  been  used,  the  entire  behavior  of  the  data  would  have  never  surfaced. 

Based  on  this  preliminary  analysis,  a  simple  rule  can  be  used  to  identify  excessive  advance  motor  load  (which  has  a 
strong  possibility  of  being  a  filter  paper  jam): 


If  (x-|XN 


Y  e"1 

al/  ^Nominal 


(X  P  Nominal)  ^  X 


where 


•  x  is  the  vector  of  SOH  measurements  (min,  max,  and  average  current) 

•  ft  Nommaiand  E  Nominai  are  the  mean  vector  and  covariance  matrix  computed  from  a  large  number  of  nominal 
SOH  measurements 


x2  =  (JX  Nominal 


^ Failure^  ^Nominal  Nominal  Failure)/ 


In  reality,  most  of  these  advance  motor  failures  were  the  result  of  allowing  the  polyester  sealing  tape  to  run  out, 
which  causes  the  filter  to  wind  around  the  drive  rollers.  This  particular  failure  mode  should  be  quite  rare  in  real 
monitoring  use.  However,  it  stands  to  reason  that  increased  motor  current  over  a  few  days  may  indicate  an  imminent 
jam  or  other  maintenance  condition. 

These  two  exploratory  analyses  show  that  there  is  real  potential  in  a  mathematical/statistical  approach  to  system 
management.  The  future  of  SOH  operation  research  for  the  radionuclide  systems  includes  about  50  more  parameters 
and  their  interdependency.  However,  the  approach  of  choice  is  to  determine  the  first  few  most  likely  failure  modes, 
as  they  become  apparent,  then  design  detection  and  then  prediction  tools  for  them.  A  list  of  analog  SOH  parameters 
for  the  ARSA  and  RASA  can  be  found  Miley  (1998)  and  Bowyer  (1999). 

Authentication 


RASA  Authentication  Software  applies  a  digital  signature  to  all  normal  outgoing  messages  that  are  e-mailed  from  a 
RASA  system  on  which  it  is  installed.  This  digital  signature  can  be  used  to  verify  that  the  message  actually  came 
from  the  source  that  it  claims  to  have,  and  that  the  contents  of  the  message  have  not  been  altered. 

The  digital  signature  conforms  to  the  S/MIME  (Secure/Multipurpose  Internet  Mail  Extensions)  standard,  version  2. 

It  specifies  adding  a  digital  signature  and  public  key  certificate  as  a  MIME  attachment  to  the  e-mail  message. 
S/MIME  is  a  developing  standard  of  the  Internet  Engineering  Task  Force  (IETF)  S/MIME  working  group  that  has 
been  widely  adopted  in  industry.  S/MIME  specifies  procedures  for  signed  and/or  encrypted  data  and  X.509  public 
key  certificates  to  be  transmitted  as  MIME  data  types.  All  public  key  information  needed  to  verify  digital  signatures 
is  embodied  within  ISO  (International  Standards  Organization)  X.509  certificates. 

The  signature  function  is  performed  by  a  tamper-evident  hardware  cryptographic  token  (the  U.S. -Government- 
developed  Fortezza  Card)  in  the  form  of  a  PC  Card  processor  card  obtained  from  a  commercial  supplier  (Spyrus, 
http://www.spyrus.com/).  The  card  is  configured  to  use  the  Digital  Signature  Standard  (DSS)  with  a  public  key  size 
of  1024  bits  and  is  capable  of  self-generating  a  private  key  and  communicating  the  new  public  key. 

The  Authentication  Software  is  constructed  on  the  client-server  model.  There  is  one  authentication  server  program. 
It  manages  interactions  with  a  Fortezza  card,  X.509  certificate  handling  and  PKCS  #7  (Public -Key  Cryptography 
Standards)  signature  generation,  and  maintains  a  database  of  public  key  certificates  for  use  in  verifying  signed 
messages.  Other  RASA  programs  connect  to  the  authentication  server  using  a  socket  interface  and  can  request  that 
operations  be  performed.  The  OpenSSL  (http://www.openssl.org/)  software  package  is  used  as  the  basis  library  for 
certificate  processing 

The  authentication  software  operates  as  a  plug-in  to  existing  RASA  control  software  (version  2.2).  When  properly 
installed,  the  authentication  software  is  automatically  recognized  by  the  RASA  control  software  and  is  used  to  sign 
outgoing  e-mail  messages.  When  the  authentication  plug-in  is  not  present,  or  is  rerno  ved,  the  RASA  control 
software  automatically  reverts  to  sending  unsigned  messages.  A  hardware  interface  card  to  receive  the  Fortezza  PC 
Card  processor  card  must  be  installed  on  the  RASA  control  computer. 

Implementation  to  Date 

The  original  work  on  the  authentication  software  was  performed  at  Sandia  National  Laboratories  (SNL).  A 
prototype  version  of  the  software  that  could  operate  on  a  RASA  system  was  constructed  in  collaboration  with  PNNL 
and  demonstrated  in  the  third  quarter  of  1999  (Harris  1999).  Subsequently,  the  demonstration  prototype  was  further 
modified  by  PNNL  to  operate  in  a  production  mode  with  RASA  control  software. 


Modifications  for  the  demonstration  included  porting  the  Sandia  software  to  the  operating  system  that  RASA  uses 
(QNX,  http://www.qnx.com).  The  standard  driver  software  for  the  Fortezza  card  (the  Cl  Library)  was  also  ported  to 
QNX.  This  allowed  software  that  already  uses  the  Fortezza  card  with  Cl  Library  calls  to  be  easily  ported  and  used 
on  the  RASA. 

Subsequent  modifications  focused  on  reliable  operation  of  the  software  under  actual  operating  conditions  and  upon 
the  "plug-in"  interface  that  allows  it  to  be  easily  added  to  or  removed  from  an  existing  RASA  installation.  Most  of 
the  modifications  needed  to  achieve  reliable  operations  were  due  to  the  differences  between  QNX  and  Unix  (for 
example,  a  limitation  on  the  maximum  size  of  a  message  sent  via  a  socket  connection). 

Version  1.0  of  the  RASA  Authentication  Software  has  been  tested  on  the  two  RASA  stations  at  Hanford  (USX01 
and  USX03)  using  a  Spyrus  Fortezza  card.  The  software  was  installed  and  used  to  sign  normal  outgoing  RASA  e- 
mail  messages.  Results  were  observed  for  several  days  of  operation.  The  e-mail  reader  functions  of  both  Netscape 
and  Internet  Explorer  browsers  were  used  to  verify  that  the  signatures  for  the  e-mail  messages  would  authenticate. 
Only  the  initial  self-signed  X509  certificates  have  been  used  for  these  tests.  Third-party  signed  certificates  have  not 
been  tested. 


Future  work  being  considered  includes:  Modifying 
the  software  to  work  with  hardware  tokens  that 
conform  to  the  PKCS  #11  token  interface  standard; 
testing  the  system  with  authentication-only 
hardware  tokens  (subject  to  lesser  cryptographic 
export  regulation);  and  fully  supporting  X509 
certificate  management  (signature  by  approved 
certificate  authority  using  approved  methods). 

Cascade  Summing 

Cascade  summing  was  brought  up  in  Working 
Group  B  as  an  important  issue  that  could  stall 
efforts  to  implement  final  software  at  the 
International  Data  Centre  for  automatic 
radionuclide  analysis  (Miley  et  al,  1999).  Cascade 
summing  can  be  an  important  consideration  for 
measuring  isotopes  that  decay  by  emitting  two  or 
more  gamma-rays  in  succession.  Many  important 
fission  products  and  calibration  isotopes  have  this 
property.  Cascade  summing  is  negligible  when  the 
source  of  radiation  is  at  a  reasonable  distance  from 
the  detector,  say  as  little  as  10  cm  for  a  point-like 
source  and  a  10-cm  diameter  detector.  However, 
systems  designed  for  detection  of  trace  levels  of 
radiation  usually  have  maximal  contact  between 
the  source  and  detector. 


Table  1.  Measured  cascade  summing  effect  for  some  fission 
products  of  interest. 


Fission  Product 

Energy 

(keV) 

Gammas 

/sec 

@  10  cm 

Gammas 

/sec 
@  0  cm 

Expt 

Ratio 

Zr-95 

756.7 

203.0 

196.0 

0.966 

Nb-95 

765.8 

64.0 

62.6 

0.978 

Mo-99/Tc-99m 

140.5 

1388.0 

1035.0 

0.746 

Ru-103 

Rh-105 

497.1 

319.1 

288.7 

270.9 

0.938 

N/A 

Ag-111 

342.1 

- 

- 

- 

Cd-115m 

933.8 

- 

- 

- 

Sn-125 

1067.1 

- 

- 

- 

Sb-125 

427.9 

- 

- 

- 

1-131 

364.5 

569.9 

486.5 

0.854 

Ba-140 

537.0 

355.7 

340.5 

0.957 

La-140 

Ce-141 

1596.2 

145.4 

1343.0 

1030.0 

0.767 

N/A 

Ce-143 

293.3 

114.4 

86.5 

0.756 

Nd-147 

531.0 

84.7 

80.5 

0.951 

Pm- 149 

286.0 

- 

- 

- 

Pm- 151 

Sm-153 

340.1 

103.2 

“ 

“ 

N/A 

An  experiment  was  carried  out  to  estimate  the  size  of  the  summing  effect  in  several  geometries.  A  point-like  fission 
product  source  was  made  and  measured  at  0  cm  and  10  cm  from  the  front  face  of  a  RASA  gamma -ray  detector. 

The  fission  product  spectra  were  analyzed  in  the  usual  way  with  an  automated  spectral  analysis  code  and  with 
human  analyst  review.  The  comparison  of  0  cm  and  10  cm  results  is  found  in  Table  1.  The  significant  (-25%)  effect 
in  Mo-99,  La- 140,  and  Ce-143  would  be  less  in  the  RASA  because  of  the  lower  gamma-ray  efficiency,  particularly 
at  low  energies. 


Interestingly,  gamma -ray  detectors  with  good  efficiency  at  low  energies  can  have  a  significant  problem  with  Ba-140. 
Every  decay  of  Ba-140  which  emits  the  characteristic  537  keV  gamma -ray  has  to  emit  another  43  keV  worth  of 


gamma-rays.  If  the  source  is  at  the  front  face  of  the  detector  and  if  the  detector  has  essentially  no  absorber  on  its 
front  face,  many  or  most  of  the  537 -keV  gamma-rays  will  sum  with  all  or  part  of  the  43  keV,  thereby  greatly 
diminishing  the  537-keV  line.  This  can  be  easily  rectified  by  adding  absorber  material  to  replace  the  normal  0.7  mm 
of  useless  Ge  on  a  P-type  detector. 


The  effect  of  cascade  summing  on  calibration  data  has  been  estimated  by 
use  of  the  Monte  Carlo  code,  CraZy  (Miley,  1993).  These  computations 
show  that  the  effect  of  summing  at  10  cm  is  negligible,  at  0  cm  is  worthy  of 
consideration,  and  for  the  RASA  geometry  is  one-half  to  one -third  as  large 
as  at  0  cm.  It  should  be  noted  that  the  1-sigma  statistical  uncertainties  in  the 
10-cm  values  are  of  the  order  of  30%  because  of  the  relatively  low 
efficiency  of  that  geometry.  Around  10  million  histories  each  for  8  scenarios 
were  required  to  compute  the  10-cm  values  even  that  well. 

CONCLUSIONS  AND  RECOMMENDATIONS 


Table  2.  Simulated  corrections  in 
calibration  lines 


Energy 

0  cm 

RASA 

10  cm 

898 

29% 

12% 

2.6% 

1173 

31% 

10% 

3.4% 

1332 

32% 

12% 

1.6% 

1836 

32% 

12% 

2.4% 

The  authentication  work  done  to  date  will  likely  require  follow-up  to  extend  the  cryptological  hardware  supported. 

In  addition,  reasonable  structures  for  key  management  need  to  be  addressed  throughout  the  International  Monitority 
System.  This  will  be  observed  as  an  evolving  process  of  standard  selection  and  adoption,  with  trickle  down 
occurring  into  the  field  hardware  over  a  period  of  years.  Command  authentication  will  also  likely  require  investment 
and  will  have  a  similar  implementation  profile. 

Analysis  of  state -of-health  parameters  has  great  potential  rewards  in  uptime  and  effective  cost  of  ownership  of  the 
radionuclide  systems.  Additional  development  in  SOH  data  management  is  required  to  allow  the  SOH  data  to  be 
useful.  In  particular,  the  payoff  in  germanium  detector  uptime  alone  is  worth  a  considerable  investment  into  the 
understanding  of  its  failure  modes. 

Finally,  it  will  likely  be  necessary  to  revisit  basic  topics  in  gamma -ray  spectrometry  several  more  times  before  the 
small  errors,  approximations,  and  short-cuts  in  the  analysis  of  the  radionuclide  data  are  ironed  out.  The  best 
approach  to  take  when  these  events  occur  is  to  seek  expert  guidance,  perform  simple  experiments  and  calculations, 
and  to  engage  the  expert  community  as  early  as  possible  to  prevent  wildly  non-optimal  procedures  and  policies  from 
being  posited. 
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